| splunk |
Detect Renamed RClone |
deprecated |
2026-09-23 |
| elastic |
M365 OneDrive/SharePoint Excessive File Downloads |
production |
2026-09-18 |
| elastic |
High Number of Protected Branch Force Pushes by User |
production |
2026-09-18 |
| elastic |
Several Failed Protected Branch Force Pushes by User |
production |
2026-09-18 |
| elastic |
High Number of Closed Pull Requests by User |
production |
2026-09-18 |
| elastic |
GitHub Exfiltration via High Number of Repository Clones by User |
production |
2026-09-18 |
| elastic |
GitHub Private Repository Turned Public |
production |
2026-09-18 |
| elastic |
AWS EC2 Full Network Packet Capture Detected |
production |
2026-09-18 |
| splunk |
Detect RClone Command-Line Usage |
production |
2026-07-14 |
| splunk |
Windows Mustang Panda USB Tool Execution |
production |
2026-05-13 |
| sigma |
Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet |
experimental |
2026-03-01 |
| sigma |
PowerShell Script With File Upload Capabilities |
test |
2025-07-18 |
| sigma |
Modification or Deletion of an AWS RDS Cluster |
experimental |
2024-12-06 |
| sigma |
Mail Forwarding/Redirecting Activity In O365 |
test |
2024-11-17 |
| sigma |
Github Fork Private Repositories Setting Enabled/Cleared |
test |
2024-07-29 |
| sigma |
Github Repository/Organization Transferred |
test |
2024-07-29 |
| sigma |
PowerShell Script With File Hostname Resolving Capabilities |
test |
2023-05-05 |
| sigma |
Suspicious Inbox Forwarding |
test |
2022-10-09 |
| sigma |
Restore Public AWS RDS Instance |
test |
2022-10-09 |
| sigma |
AWS RDS Master Password Change |
test |
2022-10-05 |
| sentinel |
A host is potentially running a hacking tool (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
NRT Multiple users email forwarded to same destination |
NRT |
— |
| sentinel |
Users searching for VIP user activity |
Scheduled |
— |